Microsoft urges Entra ID admins to migrate users to passkeys

Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027.

This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios.

Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts.

Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods.

"Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.

"SMS and voice are vulnerable to phishing and SIM-swap attacks. Microsoft recommends passkeys for stronger, phishing-resistant protection. You can also migrate to another supported authentication method or retain SMS and voice by configuring a customer-managed telecom provider (CYOT) through the Microsoft Security Store."

As Microsoft noted in a previous reminder issued in September, admins with the Authentication Policy Administrator, Global Reader, or Security Reader roles can find users with SMS or voice authentication with the Entra SMS/Voice Policy Scanner PowerShell script.

Organizations that must use phone-based authentication have to configure third-party telecom providers through the Microsoft Security Store.

Passkeys now the default Entra ID auth method

In July, Microsoft announced that passkeys will start rolling out as the default authentication experience for the Entra ID enterprise identity service starting in September.

"As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multifactor authentication, they'll be prompted to register a passkey," Microsoft said.

"Following this transition, on February 1, 2027, Microsoft will retire Microsoft-provided telecom delivery for SMS and voice authentication and will no longer offer SMS and voice as a native Microsoft Entra capability."

Microsoft also retired SMS first-factor sign-in for Microsoft Entra ID Free tenants in August due to phishing, fraud, and account compromise risks, and stopped enabling it for newly created tenants.

Detailed guidance on deploying and managing phishing-resistant passwordless authentication in Entra ID is available on this dedicated Microsoft documentation page.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report